[disassembler] Handle the case of optimized code object with unlinked deopt data.

Bug: v8:6906
Change-Id: I8e9ef0fe6314cac34396c9690db993f09e67c806
Reviewed-on: https://chromium-review.googlesource.com/725343Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48673}

src/objects.cc

@@ -14175,6 +14175,11 @@ void print_pc(std::ostream& os, int pc) {
 
 void DeoptimizationInputData::DeoptimizationInputDataPrint(
     std::ostream& os) {  // NOLINT
+  if (length() == 0) {
+    os << "Deoptimization Input Data invalidated by lazy deoptimization\n";
+    return;
+  }
+
   disasm::NameConverter converter;
   int const inlined_function_count = InlinedFunctionCount()->value();
   os << "Inlined functions (count = " << inlined_function_count << ")\n";

test/mjsunit/regress/regress-v8-6906.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+%DeoptimizeFunction(f);
+
+%DisassembleFunction(f);